Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2026-61555: OpenEXR can crash when handling crafted image files
CVE-2026-61555 · published 2 months ago
Summary
The OpenEXR library used for high‑resolution images may stop working if it opens a specially crafted EXR file with a missing multi‑view attribute. This can cause applications that rely on the library to unexpectedly close. Update OpenEXR to version 3.2.11, 3.3.13, or 3.4.14 or later to prevent the crash.
What to do
- Update debian openexr to version 3.4.14-0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | openexr | All versions |
| – | academysoftwarefoundation | openexr | < 3.2.11 |
| Debian:11 | debian | openexr | All versions |
| Debian:12 | debian | openexr | All versions |
| Debian:13 | debian | openexr | All versions |
| Debian:14 | debian | openexr |
< 3.4.14-0.1 Fix: upgrade to 3.4.14-0.1
|
Original advisory text
OpenEXR: Empty multiView viewFromChannelName file crash
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an empty multiView header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
References
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-g8... Vendor Advisory
- https://github.com/AcademySoftwareFoundation/openexr/commit/6c6bc2d485f1435d3776... Patch
- https://github.com/AcademySoftwareFoundation/openexr/commit/b4257c7740a05071262e... Patch
- https://ubuntu.com/security/CVE-2026-61555 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-61555 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-61555 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61555... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-61555 Vendor Advisory
- https://github.com/AcademySoftwareFoundation/openexr/commit/c6d3796918f8e358c9c3... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-125Out-of-bounds Read
Timeline
Published25 Aug 2026
Updated26 Oct 2026
First seen25 Aug 2026
Sources
CVE-2026-61555 · NVD
CVE-2026-61555 · MITRE
DEBIAN-CVE-2026-61555 · OSV
UBUNTU-CVE-2026-61555 · OSV
CVE-2026-61555 · OSV
GHSA-g8f2-r72m-48vx · GHSA
Track software like this
Free during beta